SDSI Risk Events And Requirements — 20 Questions

Question 1

Which TWO of the following are primary components of a Cisco SecureX threat response workflow designed to mitigate a ransomware event?

Accepted Answer

Threat intelligence enrichment from Cisco Talos.. SecureX uses enrichment via threat intelligence and remediation via integrated product APIs.

Answer

Upgrading firmware on all network access devices.

Answer

Manual manual configuration of VLANs on the core switch.

Answer

Redeploying the entire network infrastructure from backups.

Question 2

When assessing the risk of 'Data Loss' via USB devices, which Cisco product provides the best control for endpoint-based DLP?

Accepted Answer

Cisco Secure Endpoint (with device control/DLP integration).. Cisco Secure Endpoint provides endpoint protection, but Cisco often integrates third-party DLP agents or uses Cisco Secure Firewall for network-level DLP.

Answer

Cisco Stealthwatch.

Answer

Cisco ISE.

Answer

Cisco Umbrella.

Question 3

An organization is conducting a risk assessment and identifies a requirement for high-availability secure access. In a Cisco ASA-based design, which feature ensures stateful failover occurs without disrupting active connections?

Accepted Answer

Active/Active failover with state synchronization configured.. Stateful failover syncs the connection state table between active and standby units, allowing seamless transitions.

Answer

Configuring OSPF adjacency timers for sub-second convergence.

Answer

HSRP (Hot Standby Router Protocol) on the interfaces.

Answer

Cisco Adaptive Security Device Manager (ASDM) Cluster monitoring.

Question 4

During a post-incident review, an architect identifies that Cisco Stealthwatch (Secure Network Analytics) failed to alert on lateral movement due to lack of visibility. Which design modification is required to ensure visibility into internal east-west traffic?

Accepted Answer

Enable NetFlow export from core and distribution layer switches to the Stealthwatch Flow Collector.. Stealthwatch requires flow data (NetFlow/IPFIX/Stealthwatch Flow Sensor) from internal switches and routers to analyze east-west traffic patterns.

Answer

Update the Cisco Secure Endpoint policy to scan memory more frequently on all endpoints.

Answer

Increase the logging interval on the perimeter Cisco Firepower Management Center.

Answer

Integrate the Cisco ISE platform via pxGrid to force all internal hosts to re-authenticate.

Question 5

When assessing risk for a remote office branch, the architect decides to use Cisco Umbrella. Which requirement is addressed by implementing the Umbrella roaming client for branch endpoints?

Accepted Answer

Enforcing security policies on endpoints even when they are off the corporate network.. Roaming clients ensure security policies are applied regardless of the network location, satisfying mobile user risk requirements.

Answer

Providing deep packet inspection for local branch-to-branch file transfers.

Answer

Managing local firewall rules on the branch router.

Answer

Providing local site-to-site VPN encryption for branch traffic.

Question 6

A security architect is designing a SOC response workflow using Cisco SecureX Orchestration. Which mechanism is most effective for automated remediation of an endpoint identified as compromised via Cisco Secure Endpoint?

Accepted Answer

Triggering a workflow that executes the isolate endpoint action in Cisco Secure Endpoint via API.. Cisco SecureX Orchestration uses workflow automation to link threat intelligence from Secure Endpoint to automated containment actions like isolation.

Answer

Deploying an umbrella policy change to redirect the host traffic to a sinkhole.

Answer

Configuring a local script on the Cisco ASA to block the host IP address.

Answer

Using Cisco Defense Orchestrator to push a new access control policy to the endpoint.

Question 7

A security architect is adapting a design post-incident after a credential theft event. Which Cisco ISE feature should be integrated into the architecture to mitigate the risk of compromised static credentials?

Accepted Answer

Enabling MFA integration with Cisco Duo via RADIUS.. Cisco ISE supports Multi-Factor Authentication (MFA) integration via RADIUS/TACACS+ to mitigate credential theft risk.

Answer

Deploying Cisco pxGrid to share user identity info with the firewall.

Answer

Configuring Cisco TrustSec to segment user traffic based on IP address.

Answer

Implementing Cisco AnyConnect Device Posture assessment.

Question 8

Following a ransomware incident, an architect must modify the network segmentation strategy. What is the most effective approach to mitigate lateral movement using Cisco TrustSec?

Accepted Answer

Implement SGT-based micro-segmentation at the access layer to enforce policies based on identity rather than IP.. TrustSec SGTs (Scalable Group Tags) allow for dynamic policy enforcement regardless of IP address, making it ideal for mitigating lateral movement.

Answer

Deploy extended ACLs on every core switch port to block peer-to-peer traffic.

Answer

Configure static port-security across the entire enterprise to prevent unauthorized devices.

Answer

Transition all physical cabling to private VLANs without leveraging SGTs.

Question 9

A design requirement for a new SOC environment mandates that incident data must be centralized. Which Cisco tool is best suited to act as the single pane of glass for integrating disparate security logs and telemetry?

Accepted Answer

Cisco SecureX. Cisco SecureX is designed as an open platform to aggregate data from multiple Cisco and third-party security products.

Answer

Cisco Firepower Management Center (FMC)

Answer

Cisco Identity Services Engine (ISE)

Answer

Cisco Defense Orchestrator (CDO)

Question 10

A security architect is designing a SIEM integration for a distributed enterprise. Which tool selection criteria best aligns with the requirement to support real-time correlation across disparate cloud and on-premises environments?

Accepted Answer

Prioritize tools that support native Common Event Format (CEF) ingestion and bidirectional API integrations.. The ability to normalize logs from heterogeneous sources is critical for effective correlation in hybrid environments.

Answer

Choose tools that utilize a monolithic database structure to ensure data consistency.

Answer

Focus on tools that strictly utilize hardware-based packet capture for all telemetry.

Answer

Select tools based solely on the number of pre-built connectors available in the marketplace.

Question 11

When designing a post-incident security architecture, which THREE factors are critical for determining the placement of Cisco Secure Firewall sensors?

Accepted Answer

Physical segmentation of the network (VLANs/VRFs).. Sensor placement must account for visibility, traffic volume, and policy enforcement needs.

Answer

The number of users connected to the local office Wi-Fi.

Answer

Local temperature of the server room.

Question 12

A design requirements gathering phase identifies that users frequently access untrusted SaaS applications. Which Cisco solution should be included to mitigate data exfiltration risks?

Accepted Answer

Cisco Umbrella with CASB capability enabled.. Cisco Cloud Access Security Broker (CASB) functionality within Cisco Umbrella provides visibility and control over SaaS usage.

Answer

Cisco Secure Firewall with IPS enabled.

Answer

Cisco AnyConnect VPN.

Answer

Cisco Identity Services Engine (ISE).

Question 13

An organization experiences a surge in successful phishing attacks. The post-incident architecture adaptation requires automated email analysis. Which Cisco product provides the necessary API for integrating email sandboxing data into a SOAR platform?

Accepted Answer

Cisco Secure Email API.. Cisco Secure Email (formerly ESA) offers extensive APIs for extracting threat intelligence and sandboxing results from Advanced Malware Protection (AMP).

Answer

Cisco Firepower Management Center REST API.

Answer

Cisco Defense Orchestrator API.

Answer

Cisco Identity Services Engine ERS API.

Question 14

A SOC analyst requires a tool to gain visibility into encrypted traffic without full decryption. Which Cisco product feature should be included in the design to meet this requirement?

Accepted Answer

Cisco Encrypted Traffic Analytics (ETA).. Cisco Encrypted Traffic Analytics (ETA) on Cisco Catalyst switches/routers uses machine learning to identify threats in encrypted streams.

Answer

Cisco Firepower SSL decryption policies.

Answer

Cisco AnyConnect Network Visibility Module (NVM).

Answer

Cisco Identity Services Engine (ISE) Profiling.

Question 15

Which risk assessment methodology is best suited to guide a design modification for a cloud-native architecture relying on Cisco Secure Cloud Analytics?

Accepted Answer

NIST SP 800-30 for conducting the assessment.. NIST SP 800-30 is a standard for conducting risk assessments that inform architectural security controls.

Answer

ISO 27002 implementation guide.

Answer

OWASP Top 10 for all infrastructure components.

Answer

PCI-DSS compliance checklist.

Question 16

A design requirement specifies that all remote access must be verified through device health checks. Which Cisco tool allows for this posture assessment?

Accepted Answer

Cisco AnyConnect Secure Client with Compliance Module.. Cisco AnyConnect (now Secure Client) performs device posture checks using the AnyConnect Compliance Module.

Answer

Cisco Identity Services Engine (ISE) pxGrid.

Answer

Cisco Umbrella roaming client.

Answer

Cisco Secure Firewall VPN portal.

Question 17

An organization is updating its SOC incident response toolset. Which Cisco technology provides the ability to perform 'retrospective security' by tracking files that have entered the network in the past?

Accepted Answer

Cisco Secure Endpoint (AMP).. Cisco Secure Endpoint (formerly AMP for Endpoints) performs retrospective analysis by continuously monitoring file activity over time.

Answer

Cisco Secure Network Analytics (Stealthwatch).

Answer

Cisco Firepower IPS.

Answer

Cisco Umbrella.

Question 18

Which TWO methods are used by Cisco Stealthwatch to detect anomalies in network traffic?

Accepted Answer

Behavioral baseline modeling of host and network patterns.. Stealthwatch uses behavioral modeling and flow data analysis to detect threats.

Answer

Signature-based matching for every packet.

Answer

Deep packet inspection of every payload byte.

Answer

Manual input of all known malicious IP addresses.

Question 19

A security architect is developing a requirements document for a SOC. Which Cisco capability allows the SOC to prioritize alerts by correlating threats across network, endpoint, and cloud?

Accepted Answer

Cisco SecureX cross-product correlation.. Cisco SecureX provides cross-product correlation to reduce alert fatigue and prioritize incidents.

Answer

Cisco Stealthwatch alert grouping.

Answer

Cisco Secure Firewall management center alert correlation.

Answer

Cisco Identity Services Engine monitoring.

Question 20

During a design review, it is determined that the current logging architecture is missing context for user identity. Which Cisco tool must be integrated with the firewall to map IP addresses to specific usernames in the logs?

Accepted Answer

Cisco Identity Services Engine (ISE).. Cisco ISE provides the identity context (IP to user mapping) that can be sent to firewalls via pxGrid or SXP.

Answer

Cisco Defense Orchestrator.

Answer

Cisco Umbrella.

Answer

Cisco SecureX.